@synopackageland/cli 0.5.3 → 0.6.0

package/dist/templates/native-go/backend/internal/filestation/repository.go

@@ -1,207 +0,0 @@
-package filestation
-
-import (
-	"context"
-	"crypto/rand"
-	"encoding/hex"
-	"encoding/json"
-	"errors"
-	"io"
-	"os"
-	"path"
-	"strings"
-	"time"
-
-	"golang.org/x/sys/unix"
-)
-
-// Selection records user consent, never DSM authority. Unlike helper grants it
-// cannot authorize an offline worker. Names/UIDs follow the relaxed identity
-// contract: recreating the same name and UID can reuse a selection.
-type Selection struct {
-	ID       string `json:"grantId"`
-	User     string `json:"user"`
-	UID      string `json:"uid"`
-	Folder   string `json:"folder"`
-	Writable bool   `json:"writable"`
-}
-type GrantRepository struct{ dir string }
-
-func NewGrantRepository(dir string) *GrantRepository { return &GrantRepository{dir: dir} }
-
-// withStore serializes CGI processes, including in-flight operations and revoke.
-// Local files are package-owned metadata only. No NAS data path is ever opened.
-func (r *GrantRepository) withStore(ctx context.Context, fn func(*[]Selection) (bool, error)) error {
-	if r == nil || r.dir == "" {
-		return fail("unavailable")
-	}
-	root, e := os.OpenRoot(r.dir)
-	if e != nil {
-		return fail("unavailable")
-	}
-	defer root.Close()
-	lock, e := root.OpenFile("session-selections.lock", os.O_CREATE|os.O_RDWR|unix.O_NOFOLLOW, 0600)
-	if e != nil {
-		return fail("unavailable")
-	}
-	defer lock.Close()
-	info, e := lock.Stat()
-	if e != nil || !info.Mode().IsRegular() || info.Mode().Perm()&0077 != 0 {
-		return fail("unavailable")
-	}
-	for {
-		e = unix.Flock(int(lock.Fd()), unix.LOCK_EX|unix.LOCK_NB)
-		if e == nil {
-			break
-		}
-		if !errors.Is(e, unix.EWOULDBLOCK) {
-			return fail("unavailable")
-		}
-		select {
-		case <-ctx.Done():
-			return fail("canceled")
-		case <-time.After(10 * time.Millisecond):
-		}
-	}
-	defer unix.Flock(int(lock.Fd()), unix.LOCK_UN)
-	if ctx.Err() != nil {
-		return fail("canceled")
-	}
-	var entries []Selection
-	f, e := root.OpenFile("session-selections.json", os.O_RDONLY|unix.O_NOFOLLOW, 0)
-	if e == nil {
-		info, se := f.Stat()
-		b, re := io.ReadAll(io.LimitReader(f, maxMetadata+1))
-		f.Close()
-		if se != nil || !info.Mode().IsRegular() || info.Mode().Perm()&0077 != 0 || re != nil || len(b) > maxMetadata || json.Unmarshal(b, &entries) != nil {
-			return fail("unavailable")
-		}
-	} else if !errors.Is(e, os.ErrNotExist) {
-		return fail("unavailable")
-	}
-	seen := map[string]bool{}
-	if len(entries) > 256 {
-		return fail("unavailable")
-	}
-	for _, g := range entries {
-		if !validID(g.ID) || g.User == "" || g.UID == "" || !validPath(g.Folder) || seen[g.ID] {
-			return fail("unavailable")
-		}
-		seen[g.ID] = true
-	}
-	change, e := fn(&entries)
-	if e != nil || !change {
-		return e
-	}
-	b, e := json.Marshal(entries)
-	if e != nil || len(b) > maxMetadata {
-		return fail("limit-exceeded")
-	}
-	nonce := make([]byte, 16)
-	if _, e = rand.Read(nonce); e != nil {
-		return fail("unavailable")
-	}
-	tmp := ".session-selections-" + hex.EncodeToString(nonce)
-	out, e := root.OpenFile(tmp, os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0600)
-	if e != nil {
-		return fail("unavailable")
-	}
-	defer root.Remove(tmp)
-	_, e = out.Write(b)
-	if e == nil {
-		e = out.Sync()
-	}
-	ce := out.Close()
-	if e != nil || ce != nil {
-		return fail("unavailable")
-	}
-	dir, e := root.Open(".")
-	if e != nil {
-		return fail("commit-uncertain")
-	}
-	defer dir.Close()
-	if unix.Renameat(int(dir.Fd()), tmp, int(dir.Fd()), "session-selections.json") != nil {
-		return fail("commit-uncertain")
-	}
-	if dir.Sync() != nil {
-		return fail("commit-uncertain")
-	}
-	return nil
-}
-func validID(id string) bool { b, e := hex.DecodeString(id); return e == nil && len(b) == 32 }
-func (r *GrantRepository) Confirm(ctx context.Context, user, uid, folder string, writable bool) (Selection, error) {
-	var g Selection
-	if user == "" || uid == "" || !validPath(folder) {
-		return g, fail("invalid-request")
-	}
-	b := make([]byte, 32)
-	if _, e := rand.Read(b); e != nil {
-		return g, fail("unavailable")
-	}
-	g = Selection{hex.EncodeToString(b), user, uid, folder, writable}
-	e := r.withStore(ctx, func(gs *[]Selection) (bool, error) {
-		if len(*gs) >= 256 {
-			return false, fail("limit-exceeded")
-		}
-		*gs = append(*gs, g)
-		return true, nil
-	})
-	return g, e
-}
-func (r *GrantRepository) WithGrant(ctx context.Context, user, uid, id string, write bool, fn func(Selection) error) error {
-	if !validID(id) {
-		return fail("denied")
-	}
-	return r.withStore(ctx, func(gs *[]Selection) (bool, error) {
-		for _, g := range *gs {
-			if g.ID == id && g.User == user && g.UID == uid && (!write || g.Writable) {
-				return false, fn(g)
-			}
-		}
-		return false, fail("denied")
-	})
-}
-func (r *GrantRepository) List(ctx context.Context, user, uid string) ([]Selection, error) {
-	out := []Selection{}
-	e := r.withStore(ctx, func(gs *[]Selection) (bool, error) {
-		for _, g := range *gs {
-			if g.User == user && g.UID == uid {
-				out = append(out, g)
-			}
-		}
-		return false, nil
-	})
-	return out, e
-}
-func (r *GrantRepository) Revoke(ctx context.Context, user, uid, id string) error {
-	return r.withStore(ctx, func(gs *[]Selection) (bool, error) {
-		for i, g := range *gs {
-			if g.ID == id && g.User == user && g.UID == uid {
-				*gs = append((*gs)[:i], (*gs)[i+1:]...)
-				return true, nil
-			}
-		}
-		return false, fail("denied")
-	})
-}
-func relative(root, rel string) (string, error) {
-	if !validPath(root) {
-		return "", fail("denied")
-	}
-	if rel == "" {
-		return root, nil
-	}
-	if strings.HasPrefix(rel, "/") || path.Clean(rel) != rel {
-		return "", fail("invalid-request")
-	}
-	for _, s := range strings.Split(rel, "/") {
-		if !validName(s) {
-			return "", fail("invalid-request")
-		}
-	}
-	p := root + "/" + rel
-	if !validPath(p) {
-		return "", fail("invalid-request")
-	}
-	return p, nil
-}

package/dist/templates/native-go/backend/internal/filestation/repository_test.go

@@ -1,104 +0,0 @@
-package filestation
-
-import (
-	"context"
-	"os"
-	"strings"
-	"testing"
-)
-
-func TestSelectionPersistenceOwnershipAndRevoke(t *testing.T) {
-	dir := t.TempDir()
-	r := NewGrantRepository(dir)
-	ctx := context.Background()
-	g, e := r.Confirm(ctx, "alice", "1000", "/home", true)
-	if e != nil {
-		t.Fatal(e)
-	}
-	r = NewGrantRepository(dir)
-	called := false
-	if e = r.WithGrant(ctx, "alice", "1000", g.ID, false, func(g Selection) error { called = true; return nil }); e != nil || !called {
-		t.Fatal(e)
-	}
-	for _, owner := range [][2]string{{"bob", "1001"}, {"alice", "1001"}, {"bob", "1000"}} {
-		if e = r.WithGrant(ctx, owner[0], owner[1], g.ID, false, func(Selection) error { t.Fatal("cross user"); return nil }); e == nil {
-			t.Fatal("accepted")
-		}
-	}
-	if e = r.Revoke(ctx, "alice", "1000", g.ID); e != nil {
-		t.Fatal(e)
-	}
-	if e = r.WithGrant(ctx, "alice", "1000", g.ID, false, func(Selection) error { t.Fatal("revoked"); return nil }); e == nil {
-		t.Fatal("accepted")
-	}
-	b, _ := os.ReadFile(dir + "/session-selections.json")
-	if strings.Contains(string(b), "test-session") {
-		t.Fatal("credentials persisted")
-	}
-}
-func TestReadonlySelectionAndTraversal(t *testing.T) {
-	r := NewGrantRepository(t.TempDir())
-	g, e := r.Confirm(context.Background(), "alice", "1000", "/home", false)
-	if e != nil {
-		t.Fatal(e)
-	}
-	if e = r.WithGrant(context.Background(), "alice", "1000", g.ID, true, func(Selection) error { t.Fatal("write admitted"); return nil }); e == nil {
-		t.Fatal("accepted")
-	}
-	for _, p := range []string{"../x", "a/../x", "/x", "a//x", "a\\x", "a,b", "a/./b"} {
-		if _, e := relative("/home", p); e == nil {
-			t.Fatal(p)
-		}
-	}
-	if p, e := relative("/home", "a/b"); e != nil || p != "/home/a/b" {
-		t.Fatal(p, e)
-	}
-}
-
-func TestRevokeWaitsForActiveOperationAcrossRepositoryInstances(t *testing.T) {
-	dir := t.TempDir()
-	a, b := NewGrantRepository(dir), NewGrantRepository(dir)
-	ctx := context.Background()
-	g, e := a.Confirm(ctx, "alice", "1000", "/home", true)
-	if e != nil {
-		t.Fatal(e)
-	}
-	entered, release, done := make(chan struct{}), make(chan struct{}), make(chan error, 1)
-	go func() {
-		done <- a.WithGrant(ctx, "alice", "1000", g.ID, true, func(Selection) error { close(entered); <-release; return nil })
-	}()
-	<-entered
-	canceled, cancel := context.WithCancel(ctx)
-	cancel()
-	if e = b.Revoke(canceled, "alice", "1000", g.ID); e == nil {
-		t.Fatal("revoked through active lock")
-	}
-	close(release)
-	if e = <-done; e != nil {
-		t.Fatal(e)
-	}
-	if e = b.Revoke(ctx, "alice", "1000", g.ID); e != nil {
-		t.Fatal(e)
-	}
-}
-
-func TestCorruptAndSymlinkStoresFailClosed(t *testing.T) {
-	for _, data := range []string{`broken`, `[{"grantId":"bad","folder":"/home"}]`} {
-		dir := t.TempDir()
-		if e := os.WriteFile(dir+"/session-selections.json", []byte(data), 0600); e != nil {
-			t.Fatal(e)
-		}
-		if _, e := NewGrantRepository(dir).List(context.Background(), "alice", "1000"); e == nil {
-			t.Fatal("corrupt accepted")
-		}
-	}
-	dir := t.TempDir()
-	target := t.TempDir() + "/outside"
-	os.WriteFile(target, []byte(`[]`), 0600)
-	if e := os.Symlink(target, dir+"/session-selections.json"); e != nil {
-		t.Fatal(e)
-	}
-	if _, e := NewGrantRepository(dir).List(context.Background(), "alice", "1000"); e == nil {
-		t.Fatal("symlink accepted")
-	}
-}

package/dist/templates/native-go/backend/internal/filestation/sdk_session.go

@@ -1,241 +0,0 @@
-//go:build synopkgland_sdk_workers
-
-package filestation
-
-import (
-	"context"
-	"dsmapp/internal/api"
-	"dsmapp/internal/helper/jobcontract"
-	"encoding/json"
-	"errors"
-	"golang.org/x/sys/unix"
-	"io"
-	"mime"
-	"net/http"
-	"os"
-	"strconv"
-	"strings"
-	"time"
-)
-
-// SessionIdentity is authenticated per request, not an offline grant, account
-// incarnation or a local ACL calculation. Admin is DSM administrators membership.
-type SessionIdentity struct {
-	User, UID string
-	Admin     bool
-}
-
-func (s *Service) CheckSession(ctx context.Context, auth api.Authenticator, r *http.Request) (SessionIdentity, error) {
-	if s == nil || s.client == nil || auth == nil || r == nil {
-		return SessionIdentity{}, fail("unavailable")
-	}
-	a, e := auth.Authenticate(r.WithContext(ctx))
-	if e != nil || a.User == "" {
-		return SessionIdentity{}, fail("session_required")
-	}
-	if e = s.client.Verify(ctx, r, a.User); e != nil {
-		return SessionIdentity{}, e
-	}
-	uid, e := s.lookupUID(a.User)
-	n, parse := strconv.ParseUint(uid, 10, 32)
-	if e != nil || parse != nil || n == 0 || strconv.FormatUint(n, 10) != uid || ctx.Err() != nil {
-		return SessionIdentity{}, fail("denied")
-	}
-	return SessionIdentity{User: a.User, UID: uid, Admin: a.Admin}, nil
-}
-func (s *Service) JobSelection(ctx context.Context, id SessionIdentity, grant string) error {
-	if s == nil || s.repository == nil {
-		return fail("unavailable")
-	}
-	return s.repository.withJobGrant(ctx, id, grant, func(Selection) error { return nil })
-}
-
-// Fixed, counter-only read plans. No NAS path is opened with POSIX APIs. This
-// shares M2 selection/revoke locking and path semantics, not inode confinement.
-func (s *Service) JobStep(ctx context.Context, r *http.Request, id SessionIdentity, grant string, step jobcontract.Step) (jobcontract.Result, error) {
-	out := jobcontract.Result{ResultSchema: 1}
-	if s == nil || s.client == nil || s.repository == nil {
-		return out, fail("unavailable")
-	}
-	if step.Action != jobcontract.List && step.Action != jobcontract.Stat && step.Action != jobcontract.Read {
-		return out, fail("unsupported")
-	}
-	for _, segment := range step.Segments {
-		if !validName(segment) {
-			return out, fail("invalid-request")
-		}
-	}
-	e := s.repository.withJobGrant(ctx, id, grant, func(g Selection) error {
-		target, e := relative(g.Folder, strings.Join(step.Segments, "/"))
-		if e != nil {
-			return e
-		}
-		switch step.Action {
-		case jobcontract.List:
-			if step.Limit == nil || *step.Limit == 0 || *step.Limit > PageSize {
-				return fail("limit-exceeded")
-			}
-			p, e := s.client.jobList(ctx, r, target, *step.Limit)
-			if e != nil {
-				return e
-			}
-			out.Entries = min(uint64(len(p.Files)), *step.Limit)
-		case jobcontract.Stat:
-			if _, e = s.client.Stat(ctx, r, target); e != nil {
-				return e
-			}
-			out.Entries = 1
-		case jobcontract.Read:
-			if step.MaxBytes == nil || *step.MaxBytes == 0 || *step.MaxBytes > MaxBytes {
-				return fail("limit-exceeded")
-			}
-			item, e := s.client.Stat(ctx, r, target)
-			if e != nil {
-				return e
-			}
-			if item.IsDir || item.Additional.Size < 0 {
-				return fail("denied")
-			}
-			if uint64(item.Additional.Size) > *step.MaxBytes {
-				return fail("limit-exceeded")
-			}
-			b, e := s.client.jobRead(ctx, r, target, *step.MaxBytes)
-			defer clear(b)
-			if e != nil {
-				return e
-			}
-			if uint64(len(b)) > *step.MaxBytes {
-				return fail("limit-exceeded")
-			}
-			out.BytesRead = uint64(len(b))
-		}
-		if ctx.Err() != nil {
-			return fail("canceled")
-		}
-		out.CompletedSteps = 1
-		return nil
-	})
-	return out, e
-}
-
-// Honor the exact step bounds at the WebAPI boundary, including a file that
-// grows after getinfo. The extra byte detects overflow and is never counted or
-// returned as a successful read.
-func (c *Client) jobRead(ctx context.Context, r *http.Request, p string, limit uint64) ([]byte, error) {
-	v := fields("SYNO.FileStation.Download", "download", "2")
-	v.Set("path", array(p))
-	v.Set("mode", "download")
-	resp, e := c.send(ctx, r, strings.NewReader(v.Encode()), "")
-	if e != nil {
-		return nil, e
-	}
-	disposition, _, _ := mime.ParseMediaType(resp.Header.Get("Content-Disposition"))
-	if disposition != "attachment" {
-		e = decode(resp, nil)
-		if e == nil {
-			e = fail("unavailable")
-		}
-		return nil, e
-	}
-	defer resp.Body.Close()
-	b, e := io.ReadAll(io.LimitReader(resp.Body, int64(limit)+1))
-	if e != nil {
-		clear(b)
-		return nil, fail("read_failed")
-	}
-	if uint64(len(b)) > limit {
-		clear(b)
-		return nil, fail("limit-exceeded")
-	}
-	if resp.ContentLength >= 0 && resp.ContentLength != int64(len(b)) {
-		clear(b)
-		return nil, fail("read_failed")
-	}
-	return b, nil
-}
-func (c *Client) jobList(ctx context.Context, r *http.Request, p string, limit uint64) (Page, error) {
-	v := fields("SYNO.FileStation.List", "list", "2")
-	v.Set("folder_path", p)
-	v.Set("offset", "0")
-	v.Set("limit", strconv.FormatUint(limit, 10))
-	v.Set("additional", `["size"]`)
-	var page Page
-	e := c.call(ctx, r, v, &page)
-	if uint64(len(page.Files)) > limit || len(page.Shares) > 0 {
-		return Page{}, fail("limit-exceeded")
-	}
-	return page, e
-}
-
-// The supervisor is root, while the M2 selection store is package-owned. This
-// read-only entry never creates, rewrites or follows a metadata file. NONBLOCK
-// plus fstat rejects FIFO/device substitutions before reading. The same flock
-// stays held through each HTTP step, serializing M2 revoke with admission.
-func (r *GrantRepository) withJobGrant(ctx context.Context, id SessionIdentity, grant string, fn func(Selection) error) error {
-	if r == nil || r.dir == "" || !validID(grant) {
-		return fail("denied")
-	}
-	root, e := os.OpenRoot(r.dir)
-	if e != nil {
-		return fail("unavailable")
-	}
-	defer root.Close()
-	open := func(name string) (*os.File, error) {
-		f, e := root.OpenFile(name, os.O_RDONLY|unix.O_NOFOLLOW|unix.O_NONBLOCK, 0)
-		if e != nil {
-			return nil, fail("unavailable")
-		}
-		st, e := f.Stat()
-		if e != nil || !st.Mode().IsRegular() || st.Mode().Perm()&0077 != 0 || st.Size() > maxMetadata {
-			f.Close()
-			return nil, fail("unavailable")
-		}
-		return f, nil
-	}
-	lock, e := open("session-selections.lock")
-	if e != nil {
-		return e
-	}
-	defer lock.Close()
-	for {
-		e = unix.Flock(int(lock.Fd()), unix.LOCK_EX|unix.LOCK_NB)
-		if e == nil {
-			break
-		}
-		if !errors.Is(e, unix.EWOULDBLOCK) {
-			return fail("unavailable")
-		}
-		select {
-		case <-ctx.Done():
-			return fail("canceled")
-		case <-time.After(10 * time.Millisecond):
-		}
-	}
-	defer unix.Flock(int(lock.Fd()), unix.LOCK_UN)
-	if ctx.Err() != nil {
-		return fail("canceled")
-	}
-	f, e := open("session-selections.json")
-	if e != nil {
-		return e
-	}
-	defer f.Close()
-	raw, e := io.ReadAll(io.LimitReader(f, maxMetadata+1))
-	var entries []Selection
-	if e != nil || len(raw) > maxMetadata || json.Unmarshal(raw, &entries) != nil || len(entries) > 256 {
-		return fail("unavailable")
-	}
-	seen := map[string]bool{}
-	for _, g := range entries {
-		if !validID(g.ID) || g.User == "" || g.UID == "" || !validPath(g.Folder) || seen[g.ID] {
-			return fail("unavailable")
-		}
-		seen[g.ID] = true
-	}
-	for _, g := range entries {
-		if g.ID == grant && g.User == id.User && g.UID == id.UID {
-			return fn(g)
-		}
-	}
-	return fail("denied")
-}